PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Blog post from Endor Labs
PHP has issued emergency patches for two critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can enable unauthenticated remote code execution through memory-safety flaws in the core engine. Affected installations should upgrade immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or use vendor packages with confirmed backported fixes, as updating CMS software or plugins alone does not address the vulnerable runtime. Researchers demonstrated attacks against WordPress, Drupal, and Joomla, including code execution and sensitive memory disclosure, with mod_php Apache deployments identified as especially high risk. Organizations are advised to inventory PHP across servers, containers, base images, and managed hosting, prioritize internet-facing systems, rebuild and redeploy patched containers, and verify the running version after deployment. If updates cannot be applied promptly, temporary access restrictions, service shutdowns, and WAF protections may reduce exposure, though PHP and Cloudflare emphasize that these measures are incomplete because attackers are already adapting payloads to bypass rules.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.